Hi, Berny, the syslog file is not being rotated, so we have no option with "ma-unchanged-stats". The issue is occurred while a read 's size less than the stat.st_size, and there has no truncated occurred. But tail treat it as truncate case and print all the data from the begin.
We has an automatic case used as "tail -F "file" > "period_log_file", which we need catch about one hour of syslog to another file. But with this pseudo-truncate issue, this command will eat all disk file of a host. Best Regards, George -----Original Message----- From: Bernhard Voelker [mailto:[email protected]] Sent: Wednesday, November 09, 2016 5:25 AM To: Lian, George (Nokia - CN/Hangzhou) <[email protected]>; Pádraig Brady <[email protected]>; [email protected] Cc: Zhang, Bingxuan (Nokia - CN/Hangzhou) <[email protected]>; Li, Deqian (Nokia - CN/Hangzhou) <[email protected]>; Zizka, Jan (Nokia - CZ/Prague) <[email protected]>; Bao, Xiaohui (Nokia - CN/Hangzhou) <[email protected]> Subject: Re: some concern about the fix of " tail: consistently output all data for truncated files" On 11/08/2016 03:50 AM, Lian, George (Nokia - CN/Hangzhou) wrote: > We have an issue now for tail a syslog file which stored in a network-based > file system. I'm not sure, but this sounds like a case for N=5 tail -F --max-unchanged-stats="$N" "$file" doesn't it? Have a nice day, Berny
